Attackers Are Turning Everyday Business Emails Into Malware Delivery Machines

Attackers are turning routine business complaints into malware traps. A message about a damaged delivery or refund request can look ordinary, yet one click leads employees to a fake download page and a harmful ZIP archive.

The campaign targeted organizations with Japanese and Korean messages between July and August 2026. Product damage, shipping problems, and exchange requests created urgency, while links appeared to host documents or videos.

Analysts at ITOCHU Cyber & Intelligence Inc. identified the activity and found pages offering Vietnamese, English, Chinese, Japanese, and Korean. Those language choices suggest the operation could extend across East and Southeast Asia.

The impact goes beyond a bad attachment. Victims can receive PureRAT, a remote access tool, or PureLogs, an information stealer. Both pose risks to sensitive business data and give attackers ways to maintain access.

ITOCHU Cyber & Intelligence Inc. said in a report shared with Cyber Security News (CSN) that the campaign repeatedly changed the software used to install its malware. Simple file-based blocking may miss variants, especially when busy teams handle routine customer correspondence.

Turning Business Emails Into Malware Delivery Machines

The lures sound like normal business follow-up. Recipients are told an item arrived damaged, a recording is available, or a refund needs review. The message directs them to a site disguised as a document-sharing or video-viewing service.

The landing page claims a file is too large to preview and asks visitors to download a ZIP archive. Some pages change language using browser settings and location, while mobile visitors see a notice that prevents the download, narrowing exposure to inspection.

This resembles earlier weaponized archive malware attacks, where an archive hides an executable behind a familiar document name. Here, one sample used a double extension to make an EXE file look like a PDF.

The archives generally pair the executable with a DLL. One sample used a legitimate Microsoft-signed program to load a malicious DLL, which was hidden and padded with unnecessary data.

That extra bulk could frustrate security tools with file-size limits, allowing the infection chain to proceed before alarms reach the security team.

Email headers offered clues. The visible sender looked like a support address, but Reply-To pointed to an unrelated Outlook or Hotmail account. Shared identifiers and a common mailer format suggested the messages came from the same delivery environment.

Organizations should verify unexpected refund requests through a separate, trusted channel before opening links. Filters can flag suspicious sharing sites, while staff should report unsolicited complaints that require downloading an archive.

Changing Loaders Hide Data Theft

Once opened, the files launch a layered infection chain. Researchers observed bundled Python software, a modified Donut loader, and code that runs in memory, with each route designed to conceal the final payload.

Variants establish persistence through Startup shortcuts, scheduled tasks, or Registry entries. Others attempt to weaken Windows scanning and logging, while one uses a signed but vulnerable driver to kill security-product processes.

This echoes trusted driver abuse attacks, where attackers exploit high-level system access to silence defenses. Security teams should investigate unexpected driver installations, new services, scheduled tasks, and failed security processes.

PureRAT reports operating-system details, active windows, user names, security products, webcam status, and screenshots to its control server. It can steal information from browsers, cryptocurrency wallets, and messaging applications, making the initial email a gateway to wider exposure.

PureLogs collects browser cookies and profiles, Discord data, screenshots, and file-search results. The final malware remains recognizable across samples, but changing loaders make detection based only on known file hashes unreliable.

Defenders should block the listed indicators, watch for archives containing disguised executables, and review alerts for DLL side-loading and persistence changes.

Recent fake file-sharing phishing campaigns show why trusted-looking portals deserve the same scrutiny as unexpected email attachments.

Combining email checks, behavior monitoring, and quick employee reporting offers stronger protection than any single file signature. A damage claim may be normal business traffic, but a surprise download request deserves closer attention.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post Attackers Are Turning Everyday Business Emails Into Malware Delivery Machines appeared first on Cyber Security News.